1win.com
Open in
urlscan Pro
190.115.24.78
Malicious Activity!
Public Scan
Effective URL: https://1win.com/
Submission Tags: @phish_report
Submission: On August 20 via api from FI — Scanned from NL
Summary
TLS certificate: Issued by R11 on August 12th 2024. Valid for: 3 months.
This is the only time 1win.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 6 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
13 | 190.115.24.78 190.115.24.78 | 59692 (IQWEB) (IQWEB) | |
4 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 185.129.100.100 185.129.100.100 | 57724 (DDOS-GUARD) (DDOS-GUARD) | |
4 | 2a00:1450:400... 2a00:1450:4001:80f::2003 | 15169 (GOOGLE) (GOOGLE) | |
3 | 104.19.230.21 104.19.230.21 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.19.229.21 104.19.229.21 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
32 | 8 |
ASN13335 (CLOUDFLARENET, US)
goldensuninn.in | |
naturewildlife.id |
ASN57724 (DDOS-GUARD, RU)
PTR: ddos-guard.net
check.ddos-guard.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
1win.com
1win.com Failed |
437 KB |
5 |
hcaptcha.com
hcaptcha.com — Cisco Umbrella Rank: 5917 newassets.hcaptcha.com — Cisco Umbrella Rank: 8953 |
52 KB |
5 |
goldensuninn.in
2 redirects
goldensuninn.in |
8 KB |
4 |
gstatic.com
fonts.gstatic.com |
75 KB |
4 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110 |
3 KB |
2 |
ddos-guard.net
check.ddos-guard.net — Cisco Umbrella Rank: 129152 |
742 B |
1 |
naturewildlife.id
1 redirects
naturewildlife.id |
476 B |
32 | 7 |
Domain | Requested by | |
---|---|---|
13 | 1win.com |
1win.com
|
5 | goldensuninn.in |
2 redirects
goldensuninn.in
|
4 | newassets.hcaptcha.com |
hcaptcha.com
|
4 | fonts.gstatic.com |
fonts.googleapis.com
|
4 | fonts.googleapis.com |
1win.com
|
2 | check.ddos-guard.net |
1win.com
|
1 | hcaptcha.com |
1win.com
|
1 | naturewildlife.id | 1 redirects |
32 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
ddos-guard.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
goldensuninn.in WE1 |
2024-08-16 - 2024-11-14 |
3 months | crt.sh |
1win.com R11 |
2024-08-12 - 2024-11-10 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
*.ddos-guard.net Sectigo RSA Domain Validation Secure Server CA |
2024-07-11 - 2025-08-11 |
a year | crt.sh |
*.gstatic.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
hcaptcha.com WE1 |
2024-07-10 - 2024-10-08 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://1win.com/
Frame ID: BAD7D88D7C30E01FEFAE702C8DD2935A
Requests: 32 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/4e17d72/static/hcaptcha.html
Frame ID: C81B0B0ACCF4BB96134998C7837B45CA
Requests: 1 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/4e17d72/static/hcaptcha.html
Frame ID: CA41532F80C8042A19CCFF712BB6D83E
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
DDoS-GuardPage URL History Show full URLs
- https://goldensuninn.in/kbo77-art/ Page URL
-
https://goldensuninn.in/cdn-cgi/phish-bypass?atok=3RHwCp8gt9awts.yAqMtCLl8kqpbn5HmsNOjhZYD.tU-172412...
HTTP 301
https://goldensuninn.in/kbo77-art/ HTTP 301
https://naturewildlife.id/ HTTP 301
https://1win.com/ Page URL
- https://1win.com/ Page URL
Detected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
hCaptcha (Security) Expand
Detected patterns
- https://hcaptcha.com/([\d]+?)/api.js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: DDoS-Guard
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://goldensuninn.in/kbo77-art/ Page URL
-
https://goldensuninn.in/cdn-cgi/phish-bypass?atok=3RHwCp8gt9awts.yAqMtCLl8kqpbn5HmsNOjhZYD.tU-1724125747-0.0.1.1-%2Fkbo77-art%2F
HTTP 301
https://goldensuninn.in/kbo77-art/ HTTP 301
https://naturewildlife.id/ HTTP 301
https://1win.com/ Page URL
- https://1win.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- https://goldensuninn.in/favicon.ico HTTP 301
- https://naturewildlife.id/ HTTP 301
- https://1win.com/
- https://goldensuninn.in/cdn-cgi/phish-bypass?atok=3RHwCp8gt9awts.yAqMtCLl8kqpbn5HmsNOjhZYD.tU-1724125747-0.0.1.1-%2Fkbo77-art%2F HTTP 301
- https://goldensuninn.in/kbo77-art/ HTTP 301
- https://naturewildlife.id/ HTTP 301
- https://1win.com/
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
/
goldensuninn.in/kbo77-art/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cf.errors.css
goldensuninn.in/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-exclamation.png
goldensuninn.in/cdn-cgi/images/ |
452 B 635 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
1win.com/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
1win.com/ Redirect Chain
|
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
14 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
4 KB 688 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
1win.com/.well-known/ddos-guard/js-challenge/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
view.js
1win.com/.well-known/ddos-guard/js-challenge/ |
50 KB 50 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
1win.com/.well-known/ddos-guard/js-challenge/ |
142 KB 142 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
check.js
check.ddos-guard.net/ |
152 B 490 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tat8jWgYpWv0p4AX
1win.com/.well-known/ddos-guard/id/ |
68 B 212 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tat8jWgYpWv0p4AX
check.ddos-guard.net/set/id/ |
68 B 252 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
fonts.gstatic.com/s/opensans/v40/ |
42 KB 42 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
fonts.gstatic.com/s/montserrat/v26/ |
32 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
272 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
1win.com/ |
1 KB 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
1win.com/.well-known/ddos-guard/mark/ |
0 0 |
Fetch
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
1win.com/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
14 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
4 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
1win.com/.well-known/ddos-guard/h-captcha/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
1win.com/.well-known/ddos-guard/h-captcha/ |
183 KB 183 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
view.js
1win.com/.well-known/ddos-guard/h-captcha/ |
51 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
hcaptcha.com/1/ |
147 KB 48 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
fonts.gstatic.com/s/opensans/v40/ |
42 KB 0 |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
fonts.gstatic.com/s/montserrat/v26/ |
32 KB 0 |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
521 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/4e17d72/static/ Frame C81B |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/4e17d72/static/ Frame CA41 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
nl.json
newassets.hcaptcha.com/captcha/v1/4e17d72/static/i18n/ |
9 KB 4 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
nl.json
newassets.hcaptcha.com/captcha/v1/4e17d72/static/i18n/ |
9 KB 0 |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
1win.com/ |
2 KB 2 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
1win.com/.well-known/ddos-guard/mark/ |
0 0 |
Fetch
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- 1win.com
- URL
- https://1win.com/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 function| callbackHCaptcha object| Raven object| hcaptcha object| grecaptcha8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.goldensuninn.in/ | Name: __cf_mw_byp Value: 3RHwCp8gt9awts.yAqMtCLl8kqpbn5HmsNOjhZYD.tU-1724125747-0.0.1.1-/kbo77-art/ |
|
.1win.com/ | Name: __ddgid_ Value: ZbOCA6wxYDBrpCrw |
|
.1win.com/ | Name: __ddgmark_ Value: ZGkpMTlFr4YPeXc2 |
|
.1win.com/ | Name: __ddg5_ Value: yq5wjok6qlmVlUI9 |
|
.check.ddos-guard.net/ | Name: __ddg2 Value: tat8jWgYpWv0p4AX |
|
.1win.com/ | Name: __ddg2_ Value: tat8jWgYpWv0p4AX |
|
.1win.com/ | Name: __ddg3 Value: jhVnAF0EWalVieg5 |
|
api2.hcaptcha.com/ | Name: __cflb Value: 04dTobrcPfCH2Cv1uxYioAFTikqddqvb2SLoxZQYSH |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1win.com
check.ddos-guard.net
fonts.googleapis.com
fonts.gstatic.com
goldensuninn.in
hcaptcha.com
naturewildlife.id
newassets.hcaptcha.com
1win.com
104.19.229.21
104.19.230.21
185.129.100.100
188.114.96.3
190.115.24.78
2a00:1450:4001:80f::2003
2a00:1450:4001:812::200a
029cc2f140cb5c99fc2b93421448fafb13c90552721ffe4904bf95349e9e3436
07ad9baf097b69322607ebcfd678242d50483fb236a60fdecda2bb03006da646
1f728b4e6ac024692eb7533976e7828deacdc4b18a786ae705d21a005c256cfc
29232bcae02c36eedc72fa27e6a41d126af97287d2e4523a0bbed695ee61a965
336279027cc8064930b80885793e700c60ad72055c6d0dcfbc331490ae8b8784
34208e63c50cc27f5c13b0c29629cf0561fa788f564a07f82cf877dc28e46b82
3441ac3c8c53b517c7ce4df624544733f3d21e4d070b74dd28935525b4598def
5d16d98a18ea4a37ba56e774201922318a9898f65b523a9582c76f0da0929437
6a1bfb85b1c3ec97967175c0ce08d3f3c948e3ed6e651b2a07568854613124d4
7fd31941bd51e3d9b88c36f007dc4e8d88a42be6169150f9b0692416e90abd3f
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8a7ec65f18b0289021da3b7767fcb342202f10e44a7aa8e75c450cfa1b1bd358
94a23e7f96fbde62943e5fc93c59212f68a57d2587fe51f056d20ce802e8249c
99164736d772cb2b802a89f93559ae2fdd2a3f1b9e9369462d2cf853ac45fbaf
b147dec9a50d8d173ff968d99d9e1ece3267f80bf46dea72926d61f30598a5a7
cf3a93f2f1b38b7b69153fc3accc6b94b50ff7842fa3df15b45f93f25b1cd5a6
d91e0dc28886ce12155eeb427eb1a1058e5771c97a6b67644a3f5c6ddeb1bfd5
e7a5f2643e9b93d26d81be792f062ca37569bb30743ed33e459cb4a259610d91
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f309b7c03d9cae63a9bedbee6ed655f3dbcdb194132943639344dead5f3b9710
fcde38fa8fe942a7c2a615370896c1bb06f3a4e0b476b97a3c0de7da8a869f81